#!/bin/bash
# /opt/script/iptables.rule
# kldoo 于 2008/03/12 10：34 
# 遵守GPLv2版权规则  kldoo <kldscs@gmail.com>
# 参考 鸟哥的iptables脚本 (VBird <vbird@mail.vbird.idv.tw>)
# 测试运行：
#	/opt/script/iptables/iptables.rule
#	iptables -L -n (查看iptables规则)
# 开机自动运行：
#	写入 /etc/rc.local
# 取消放火墙规则：
#	iptables -F (清除所有的已定制的规则)
#	iptables -X (杀掉所有使用者"自定"的tables)
#	iptables -Z (将所有的tables的计数与流量统计都归零)
# 	iptables -t nat -F 
#	iptables -t nat -X (清空nat表规则)
########################################################
# 1. Please input your network parameters (including your LAN NIC)
publicNIC="eth0" # This is your NIC, connect to internet. Such as ppp0...
lanNET=0  # If your have an LAN, input 1, else 0.
export publicNIC lanNET
#
# 2. First, your server's firewall settings.
# 2.1 the kernel's firewall settings.
#	TCP Flooding's setting. This setting is no good for high loading servers.
echo "1" > /proc/sys/net/ipv4/tcp_syncookies
# 	Unset reply of ping.
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
#	开启逆向路径过滤，以符合IP封包与网路界面的设定;
for i in /proc/sys/net/ipv4/conf/*/rp_filter; do
	echo "1" > $i
done
# 	Record some problens packets.
for i in /proc/sys/net/ipv4/conf/*/log_martians; do
	echo "1" > $i
done
#	取消来源路由，可以取消
for i in /proc/sys/net/ipv4/conf/*/accept_source_route; do
	echo "0" > $i
done
#	取消传送重新宣告路径的功能
for i in /proc/sys/net/ipv4/conf/*/accept_redirects; do
	echo "0" > $i
done
#	取消传送重新宣告路径的功能
for i in /proc/sys/net/ipv4/conf/*/send_redirects; do
	echo "0" > $i
done
#
# 2.2 clear rule, set the policy rule and allow lo connect.
PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin; export PATH
iptables -F
iptables -X
iptables -Z
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state RELATED -j ACCEPT
#
# 2.3 Other shell scripts...
# Deny hosts
if [ -f /opt/script/iptables/iptables.deny ]; then
	sh /opt/script/iptabes/iptables.deny
fi
# Allow hosts
if [ -f /opt/script/iptables/iptables.allow ]; then
	sh /opt/script/iptabes/iptables.allow
fi
# Other WWW rules
if [ -f /opt/script/iptables/iptables.http ]; then
	sh /opt/script/iptabes/iptables.http
fi
iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT
#
# 2.4 Allow some types of ICMP
allowICMP="0 3 3/4 4 11 12 14 16 18"
for typeICMP in $allowICMP
do
	iptables -A INPUT -i $publicNIC -p icmp --icmp-type $typeICMP -j ACCEPT
done
#
# 2.5 open some server's port 
# iptables -A INPUT -p TCP -i $publicNIC --dport  22  -j ACCEPT	# SSH
# iptables -A INPUT -p TCP -i $publicNIC --dport  25  -j ACCEPT	# SMTP
# iptables -A INPUT -p UDP -i $publicNIC  --dport  53  -j ACCEPT	# DNS
# iptables -A INPUT -p TCP -i $publicNIC --dport  53  -j ACCEPT	# DNS
iptables -A INPUT -p TCP -i $publicNIC --dport  80  -j ACCEPT	# WWW 
# iptables -A INPUT -p TCP -i $publicNIC --dport 110  -j ACCEPT	# POP3
# iptables -A INPUT -p TCP -i $publicNIC --dport 443  -j ACCEPT	# HTTPS 
iptables -A INPUT -p TCP -i $publicNIC -s 192.168.20.0/24 --dport 2211:2221 -j ACCEPT # FTP 
iptables -A INPUT -p TCP -i $publicNIC -s 192.168.1.0/24 --dport 2211:2221 -j ACCEPT # FTP 
# ports for mldonkey
iptables -A INPUT -p TCP -i $publicNIC --dport 4661  -j ACCEPT	# ed2k
iptables -A INPUT -p UDP -i $publicNIC --dport 4665  -j ACCEPT	# ed2k 
iptables -A INPUT -p TCP -i $publicNIC --dport 4662  -j ACCEPT	# Overnet
iptables -A INPUT -p UDP -i $publicNIC --dport 4662  -j ACCEPT	# Overnet
iptables -A INPUT -p UDP -i $publicNIC --dport 4663  -j ACCEPT	# Kademlia
iptables -A INPUT -p TCP -i $publicNIC --dport 6882  -j ACCEPT	# BitTorrent
#
# 4. Second, the NAT settings
if [ lanNET == 1 ]; then
	if [ -f /opt/script/iptabes/iptables.nat ]; then
		sh /opt/script/iptables/iptables.nat
	fi
fi
# IPtables rules END.

